https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85640
--- Comment #3 from Alexander Monakov <amonakov at gcc dot gnu.org> --- (first paragraph of previous comment had 'before'/'after' swapped, sorry) Also note that adjusting the testcase to use size_t rather than unsigned int for the 'len' variable (as production code probably should) avoids the issue: final value replacement doesn't need to special case len==0 then.